Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

AimBot.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.732109716501093
Filename:	AimBot.exe
Filesize:	563064
MD5:	ef804b1837c6250dd1117f4d3a46e6c8
SHA1:	bae5846cf2aa3cc28e6dd745445a54e978d6c881
SHA256:	f5a6f17555a61261e2932d6b19c2d595a4f3580b699040e8de675c3f9f310fa1
SHA512:	e395d8bf2474972d62c6849e9908dc4caabe521734b51fad6ade79f779706c06e5ef8684aaee8c12fb1ae96f655f89f8563031093a48afd4f5071eb151e70b49
SSDEEP:	12288:lKZ4uduvILVcaKMU80v/NYPQZO4WxdPGIR+p2rKI:lKzduojKt8yW4QBdqsZ
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9...WU..WU..WU.TT..WU.RTR.WU.ST..WU.VT..WU..VU..WU.cTT..WU.cST..WU.cRT..WU.b^T..WU.b.U..WU.bUT..WURich..WU........PE..L..

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Process Injection
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Process Injection
Machine Learning detection for sample	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Security Software Discovery
Contains functionality to read the PEB	Anti Debugging
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Security Software Discovery
Detected potential crypto function	System Summary	Security Software Discovery Archive Collected Data
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Found large amount of non-executed APIs	Malware Analysis System Evasion
PE / OLE file has an invalid certificate	System Summary	Security Software Discovery File and Directory Discovery
PE file contains an invalid checksum	Data Obfuscation	Security Software Discovery
Uses 32bit PE files	Compliance, System Summary	Process Injection
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing Security Software Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	Security Software Discovery File and Directory Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
Might use command line arguments	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking	Process Injection Security Software Discovery
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_93e0ad3bfaa0be6b7b72cf195b6666742ffea97e_c667c4d5_69e5e9bd-5fac-4670-b3de-37277565c757\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_93e0ad3bfaa0be6b7b72cf195b6666742ffea97e_c667c4d5_69e5e9bd-5fac-4670-b3de-37277565c757\Report.wer
Category:	dropped
Dump:	Report.wer.6.dr
ID:	dr_3
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	1.018631046286686
Encrypted:	false
Ssdeep:	192:BBFpcOef5I0BU/gjem+HzuiFaZ24IO8q8:Vhef5jBU/gjmzuiFaY4IO8q
Size:	65536
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9ADF.tmp.dmp

Mini DuMP crash report, 15 streams, Mon Oct 7 04:44:14 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER9ADF.tmp.dmp
Category:	dropped
Dump:	WER9ADF.tmp.dmp.6.dr
ID:	dr_0
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 04:44:14 2024, 0x1205a4 type
Entropy:	1.996265558508363
Encrypted:	false
Ssdeep:	768:w3MgXgkBEbBmiZM2TA/llpfF7yB5ifGySEbOX/k:6MOWBmiZM2TA/llpfF7yB5ifGj0U/k
Size:	108568
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BDA.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BDA.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER9BDA.tmp.WERInternalMetadata.xml.6.dr
ID:	dr_1
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.726105135664672
Encrypted:	false
Ssdeep:	96:RSIU6o7wVetbhq6RwCYiQE/jTz5aM4U7n89bxYsf4fjEGm:R6l7wVeJhq6iCYi5prb89bxYsf4rbm
Size:	6296
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C0A.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C0A.tmp.xml
Category:	dropped
Dump:	WER9C0A.tmp.xml.6.dr
ID:	dr_2
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.471586440937117
Encrypted:	false
Ssdeep:	48:cvIwWl8zsJJg77aI9HUWpW8VYeYm8M4J8hFT+q8yRmLfd:uIjfbI7lN7V6JitmLfd
Size:	4636
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.6.dr
ID:	dr_4
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.372974139257518
Encrypted:	false
Ssdeep:	6144:fFVfpi6ceLP/9skLmb0vyWWSPtaJG8nAge35OlMMhA2AX4WABlguNYiL:NV1lyWWI/glMM6kF7iq
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\AimBot.exe

"C:\Users\user\Desktop\AimBot.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2344
Target ID:	1
Parent PID:	4084
Name:	AimBot.exe
Path:	C:\Users\user\Desktop\AimBot.exe
Commandline:	"C:\Users\user\Desktop\AimBot.exe"
Size:	563064
MD5:	EF804B1837C6250DD1117F4D3A46E6C8
Time:	00:44:10
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x6b0000
Modulesize:	565248
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Machine Learning detection for sample	AV Detection
PE / OLE file has an invalid certificate	System Summary
PE file contains an invalid checksum	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Details

Is windows:	true
Is dropped:	false
PID:	6740
Target ID:	2
Parent PID:	2344
Name:	MSBuild.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Size:	262432
MD5:	8FDF47E0FF70C40ED3A17014AEEA4232
Time:	00:44:10
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x220000
Modulesize:	262144
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Silenttrinity Stager Msbuild Activity	System Summary
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Details

Is windows:	true
Is dropped:	false
PID:	1548
Target ID:	3
Parent PID:	2344
Name:	MSBuild.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Size:	262432
MD5:	8FDF47E0FF70C40ED3A17014AEEA4232
Time:	00:44:10
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xd40000
Modulesize:	262144
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Silenttrinity Stager Msbuild Activity	System Summary
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1636

Details

Is windows:	true
Is dropped:	false
PID:	2768
Target ID:	6
Parent PID:	1548
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1636
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	00:44:13
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xd0000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

frizzettei.sbs

https://bleedminejw.buzz/api

172.67.178.50

bemuzzeki.sbs

invinjurhey.sbs

exilepolsiy.sbs

exemplarou.sbs

laddyirekyi.sbs

https://frizzettei.sbs/api

188.114.96.3

wickedneatr.sbs

isoplethui.sbs

bleedminejw.buzz

https://frizzettei.sbs/apiPs

unknown

http://upx.sf.net

unknown

https://frizzettei.sbs/

unknown

There are 4 hidden URLs, click here to show them.

Domains

Name

Malicious

frizzettei.sbs

188.114.96.3

Details

Name:	frizzettei.sbs
IP:	188.114.96.3
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

bleedminejw.buzz

172.67.178.50

Details

Name:	bleedminejw.buzz
IP:	172.67.178.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Sigma detected: Silenttrinity Stager Msbuild Activity	System Summary
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking

bg.microsoft.map.fastly.net

199.232.214.172

s-part-0017.t-0009.t-msedge.net

13.107.246.45

fp2e7a.wpc.phicdn.net

192.229.221.95

IPs

Domain

Country

Malicious

188.114.96.3

frizzettei.sbs

European Union

Details

IP:	188.114.96.3
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Country:	European Union
Countrycode:	EU
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	frizzettei.sbs

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

172.67.178.50

bleedminejw.buzz

United States

Details

IP:	172.67.178.50
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	bleedminejw.buzz

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Sigma detected: Silenttrinity Stager Msbuild Activity	System Summary
Uses secure TLS version for HTTPS connections	Compliance, Networking